A centralized IT security system Project

Background information

The University of Wisconsin has a decentralized organizational structure, which then necessitated a decentralized IT organizational structure for each campus. The University of Wisconsin consists of thirteen campuses, each with a separate IT security staff and a security team. As such, there is an increased risk of a breach for each campus with many reported cases of security threats all around the world. The University of Wisconsin seeks to establish a centralized security staff for the IT function for all campuses and or colleges. Currently, there are no standards for an organization-wide system for IT security at the University of Wisconsin. As a result, students, teachers, and other staff in the school have been exposed to security breaches.

Objective and strategic fit

The project seeks to establish an organization-wide centralized IT security team to ensure that the security control systems are met. The project aims to create a standardized approach to IT security through a geographically spread system but with a centralized reporting system. The project presents an opportunity to improve technical security controls, increasing IT system security. The strategic impact of the project is that the organization will have a more secure data system that is well protected from breach and security threats. This project is quite necessary for the organization’s IT system since there is an increasing cybersecurity threat. If nothing is done to improve security by adopting a centralized IT security approach, the system will face an increased risk of a breach.

Feasibility of the project

The University of Wisconsin has separate IT departments operating on different campuses but offering similar IT services. This means there are several data centers, which are approximated to be 60. The University of Wisconsin has existing standards for centralized IT security team, but they have not been well operationalized. According to (Stolze, Pawlitzek & Wespi, 2003), 25 institutions have adopted a centralized IT security team approach, which has successfully enhanced security controls against cyber threats. Some of the existing examples of the centralized IT security system approach include the New York States and SUNY College. The order by Governor Cuoma to consolidate all data centers and servers into a single room in the SUNY College led to increased data security on top of financial savings. The estimated savings from the consolidation was fifty million dollars per year. The project, however, reported that there were several challenges. These include the need for reorganization of the management and data structure to accommodate the changes.

Business Value

The project’s implications and value to the University are so many as described below. Firstly, it will help increase compliance of the University towards both the internal and external controls and procedures provided in the IT security standards. Enhancement in the auditing compliances, as well as IT security standards compliances, will result from the automated systems and processes of this project. Secondly, the security scope will be limited and hence easy management and monitoring. The centralization of security systems means a great reduction of data centers, which translates into easy execution of plans, easy planning, and easy management, just to mention a few. All the security measures and implementations can, therefore, be concentrated into a single unit leading to high efficiency and effectiveness. Thirdly, the control over IT in the University’s point of view will increase. The University can, therefore, implement and monitor all the controls and security considerations while measuring performances from each phase. Lastly, the centralization of the IT Security System will deliver all the desired benefits discussed above at a relatively lower cost. Centralization provides a perfect utilization of employees and other scarce resources hence cutting on the costs that could be otherwise incurred. Besides, adopting a centralized IT security team reduces space utilization, energy consumption, and labor requirements

Timescales.

The project will take a total of 12 months. The project deliveries and project milestones include adopting a network and infrastructure services (4 months), adopting a system-level ERP software and applications (4 months) and developing an instructional technology system (4months).

Costing and resources management

Initially, the University of Wisconsin estimated a $1.5 million saving in the next five years upon the implementation of a centralized approach to IT security. The project will cost $300 000. The project management team and the IT department will be responsible for implementing the project.

Key  Stakeholders

A stakeholder is an entity or a person who is directly affected by the organization’s activities. There are three types of stakeholders, namely Primary stakeholders, secondary stakeholders, and excluded stakeholders. The stakeholders in the University of Wisconsin’s centralized IT system project are faculties, Social community, University Board, Government, Students, etc. Students and faculty, however, are the key stakeholders in this project. When centralizing the IT Security System, I will conduct a regular meeting and use system models to ensure that all the project deliverables are well explained to the users. This will help them feel involved, and they would provide useful insights that will enhance the project.

High-level Risks

A risk, attracted by a vulnerability, is a result of a threat exploited by an agent. The most common project risks in any project are cost risks, schedule risks, and performance risks. Other risks include strategic risks, governance risks, Legal risks, and operational risks. The Centralized IT Security System Project has the following risks.  Firstly, it has costs risk whereby the project manager could have poorly estimated the project costs, leading to insufficient funds to complete the project. Secondly, it has Schedule risks whereby the project manager could take longer than expected. Lastly, it has performance risks whereby the project can fail to meet user specifications. I will deal with the risks as follows. I will draw schedules that have slack times, ensure that all costs (both direct and indirect) are included in the cost estimations. Lastly, I will ensure that the user is involved in each phase of the project so that their needs are met.

Assumptions and Dependencies

All events that the project manager expects to occur during and throughout the lifecycle of the project, but he cannot provide convincing proofs other than their former experiences are called Project assumptions. Though they could turn out to be false, Project assumptions are usually held as true from the first day of the project and therefore affects the decision-making process on the project. The project assumptions are usually outside the control of the organization, and the project manager hopes that they come true. The project assumptions from this project include the following. Firstly, the project manager assumes that the project will not be interrupted so that it finishes within the allocated timeframe. Secondly, he (project manager) assumes that the University would be able to avail the required resources (including the manpower) and on time. Thirdly, he (project manager) assumes that the scheduled time and activities will be completed as planned. Lastly, the project manager assumes that there will not be any major technological advancement that could render the project useless. If these assumptions are not met or turn out to be false, the project completion is negatively influenced lading to underperformances in the project. Dependencies, on the other hand, is a concept to describe the order of the project’s activities and deliverables. Dependencies show which activities need to be completed before others can commence. Dependencies are clearly shown by a project schedule that has each activity labeled with their predecessor and successor activities. For example, this product requires data gathering in the first stage before the next stage (Data analysis) commences. Data analysis is, therefore, dependent on the data gathering. System implementation, as well, cannot be done before the system is developed.

References

Stolze, M., Pawlitzek, R., & Wespi, A. (2003). Visual problem-solving support for new event triage in centralized network security monitoring: challenges, tools, and benefits. IT-incident management & IT-forensics–IMF 2003.